Senior IT Risk & Cybersecurity Controls Analyst

SYSTEMTEC•McKinney, TX

3d•Remote

About The Position

SYSTEMTEC is seeking a Senior IT Risk & Cybersecurity Controls Analyst for a remote opportunity for candidates working EST hours. The candidate will support a financial services organization in strengthening its IT risk and cybersecurity control environment by translating security standards and regulatory requirements into documented, measurable, and testable controls. The role will focus on control development, effectiveness testing, PCI DSS compliance support, and remediation validation to improve risk management and audit readiness.

Requirements

Applicants must be authorized to work for any employer in the U.S. We are unable to provide sponsorship or work with Third-Party agencies.
Minimum of 5 years of experience in cybersecurity GRC, IT risk management, technology audit, control design, control testing, or regulatory compliance.
Demonstrated experience translating security policies, standards, and regulatory requirements into traceable controls, testing procedures, and supporting documentation.
Hands-on experience assessing control design and operating effectiveness, evaluating evidence, developing sampling approaches, documenting exceptions, and preparing audit-ready workpapers.
Experience reviewing remediation evidence, validating corrective actions, assessing root causes, and determining whether issue closure criteria have been met.
Working knowledge of PCI DSS requirements and experience mapping requirements to controls, evidence, ownership, and remediation activities.
Experience using RSA Archer or a comparable governance, risk, and compliance (GRC) platform to maintain control records and assessment documentation.
Knowledge of cybersecurity and control frameworks such as NIST CSF, NIST SP 800-53, CIS Controls, ISO 27001, FFIEC guidance, or SOX ITGCs.
Understanding of core cybersecurity domains, including identity and access management, cloud security, vulnerability management, logging and monitoring, network security, data protection, and incident response.
Strong analytical, technical writing, stakeholder communication, and documentation skills, with advanced proficiency in Microsoft Excel and Word.

Nice To Haves

Experience working in banking, financial services, or another highly regulated industry.
Relevant certifications such as CISA, CISSP, CISM, CRISC, CGEIT, or Security+.
Experience supporting PCI DSS readiness assessments, audits, self-assessments, or Qualified Security Assessor (QSA) activities.
Familiarity with enterprise control libraries, control rationalization, management control monitoring, and issue management processes.

Responsibilities

Analyze information security standards and regulatory requirements, maintaining traceable mappings between requirements, risks, existing controls, and supporting evidence.
Evaluate the existing control inventory to identify gaps, overlaps, redundancies, and opportunities to enhance or reuse controls before recommending new ones.
Draft and refine control statements, documenting ownership, execution frequency, evidence requirements, associated risks, control characteristics, and testing procedures.
Execute control walkthroughs and design and operating effectiveness testing; assess evidence quality, population completeness, sampling, exceptions, and results.
Validate remediation efforts by reviewing supporting evidence, confirming corrective actions address identified risks and root causes, and documenting issue-closure recommendations.
Support PCI DSS compliance activities, facilitate discussions with control owners and technical stakeholders, maintain GRC documentation, and deliver clear, accurate, audit-ready work products.